请求驱动的服务组合访问控制  

Request-driven access control for service composition

作　　者：贺正求[1] 吴礼发[1] 李华波[1] 王睿[1] 黄康宇[1] 

机构地区：[1]解放军理工大学指挥自动化学院,南京210007

出　　处：《东南大学学报（自然科学版）》2011年第3期443-448,共6页Journal of Southeast University：Natural Science Edition

基　　金：国家重点基础研究发展计划(973计划)资助项目(2007CB310804);江苏省自然科学基金资助项目(BK2010132)

摘　　要：提出了一种基于服务请求的角色映射与策略集成机制来解决服务组合中的访问控制问题.为了准确有效地建立域间角色映射,提出了唯一可映射集(unique mapping set,UMS)的概念,通过求取和搜索对应局部域角色层次的UMS,可找到满足外部服务请求的最合适可映射角色集.为了解决由于角色映射造成的域间策略冲突,将角色映射关系划分成3种不同的模式,通过建立或转换不同的角色映射模式可有效避免循环继承、SoD约束违背等常见冲突.与其他方法相比,这种冲突消解方法不仅可以保证服务请求的可满足性,而且能较好地保护各参与域的自治性和安全性.A request-driven role mapping and policy integration framework is proposed for access control in service composition.In order to establish accurate and effective role mappings among domains,the concept of unique mapping set（UMS） is presented.Through computing and searching the UMS for the role hierarchy of local domain,the most suitable role set can be acquired to satisfy the external service requests.To resolve the policy conflicts caused by role mappings,three different types of role mapping relations are defined.General conflicts like cyclic inheritance and violation of separation of duty（SoD） constraints can be avoided through establishing or transforming different mapping types.Compared with other researches,this method can not only ensure the satisfaction of external service requests but also properly preserve the autonomy and security of the participant domains.

关 键 词：服务组合 访问控制 角色映射 冲突消解 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]